Method and system for forming, managing, and coordinating a network of power generators

ABSTRACT

A method for managing an energy generation system is disclosed. The system includes a cluster of power generators connected by a connectivity network. Each power generator includes an inverter having a respective controller, and at least a data set available to the controller for controlling the respective power generator. Each inverter transmits through said connectivity network, to the other inverters of the cluster, information concerning said data set available to it, said information being sufficient to check whether the data sets available to each inverter are aligned. Each inverter receives, through said connectivity network, information concerning the data set available to other inverters of the cluster and checks whether the data set available to it is aligned with the data sets available to the other inverters of the cluster.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application claims benefit of European Patent Application No.19174016, filed May 13, 2019, and which is hereby incorporated byreference.

FIELD OF THE INVENTION

The present disclosure relates to systems and methods for setting up andmanaging a network including a cluster of power generators andrespective inverters.

BACKGROUND

The continuous increase in power demand poses serious pollution issuesand raises concern on the environmental impact of power generationprocesses. This is particularly true when fossil fuels are used togenerate thermal power, which is then converted into mechanical andelectric power. Combustion of fossil fuels (either in solid, liquid orgaseous form) generates greenhouse gas (carbon dioxide), which isconsidered responsible for climate changes.

In an attempt to reduce the environmental impact of power generation,the use of renewable energy sources has been investigated, in particularsolar and wind energy.

So-called DER (Distributed Energy Resources) systems have beendeveloped, which include systems typically using renewable energysources, including small hydro, biomass, biogas, solar, wind, andgeothermal power sources. DER systems play an increasingly importantrole for the electric power distribution system. Often DER systems aregrid-connected, i.e., they are connected to a large utility grid.Electric power generated by the power generators of renewable energysource systems is supplied to local loads connected to the system.Excess power available from the renewable energy source is delivered tothe utility grid.

Plants with photovoltaic generators, as well as other renewable energysources, such as wind turbines, shall satisfy several requirementsregarding power control. Main applications include on-demand regulationof the power flow between the renewable energy source system and theutility grid, as well as grid stability control, e.g., active powerderating or reactive power injection for compensating abnormalvoltage/frequency conditions.

Multiple generators as well as other grid-connected devices like loads,transformers, storage batteries, are part of typical commercial andindustrial plants. Typical control flow requires monitoring powersignals at a point of common coupling (hereon shortly also “PCC”)between the energy generating system and the utility grid. Based uponsaid power signals, specific actions are executed on the powergenerators of the renewable energy source system. This is usuallyimplemented with closed-loop control using PCC signals as feedback forupdating generator settings.

Moreover, current country standards are demanding for higher plantcontrol performances like reaching control targets within a precisedeadline to avoid power overflow on utility-side and/or grid faults.

Photovoltaic plants, as well as other energy generation systems,specifically those using renewable energy sources, can include a largenumber of power generators, each including an inverter, which convertsthe DC electric power, generated by the photovoltaic panels, forinstance, into suitable AC current with required frequency and phase.The power generators can be connected to local loads and to the utilitygrid, to which power exceeding the one required to operate the loads isexported. Depending upon country standards applying in the specificcountry in which the system is installed, export limitations may apply,which prevent unlimited exportation of power in the utility grid. Exportlimitation, as well as other actions to be performed on the powergenerators of a system or cluster, may require data communication amongapparatus connected to a connectivity network, for instance amonginverters and/or among power meter(s) and inverters.

It would be beneficial to provide efficient methods and systems to setup, i.e., form, manage and coordinate an inverter cluster, for powergeneration and export control.

BRIEF SUMMARY

A new method for managing an energy generation system including acluster of power generators connected by a connectivity network, isdisclosed herein. Each power generator includes an inverter having arespective controller or regulator, i.e., a control unit adapted tocontrol operation of the inverter. The control unit has at least onedata set available for controlling the respective power generator. Thedata set may include data defining the configuration of the system. Thedata set may further include operating data of the devices of thesystem, for instance quasi-static data, as exemplified later on.

According to the method disclosed herein, each inverter transmits (e.g.through a connectivity network) to the other inverters of the cluster,information concerning the data set available to it. The sharedinformation is suitable to check whether the data sets available to eachinverter are aligned, i.e., if all inverters share the same data. Forinstance, if the data set include data setting forth the configurationof the system, the information shared among the inverters is sufficientfor each inverter to check if each inverter has the same configurationloaded in it and available to the controller.

When the system is in operating condition, each inverter receives (e.g.,through the connectivity network), information concerning the data setavailable to other inverters of the cluster. Each inverter checks if thedata sets are aligned or not, i.e., if the inverters have the same dataset available to the respective controller. Each inverter can, forinstance, shift alternatively in an aligned state or in a misalignedstate. The first state is taken if the data set is identical for allinverters, i.e., the data set is synchronized (aligned). The secondstate is taken if the alignment condition is not satisfied. According tothe method disclosed herein, if the data sets are aligned, the inverterremains in an aligned state. Conversely, if the data sets aremisaligned, the inverter shifts in a misaligned state and sends datathrough the connectivity network (8) to re-align the data sets, andshifts back in the aligned state once the data sets are realigned.

To save bandwidth, in preferred embodiments, the information shared bythe inverters through the connectivity network includes a digest of atleast a portion of the data set. The synchronized (aligned) conditioncan be checked by comparing digests of data sets shared among inverters.If the digests are identical to one another, the system is aligned. Ifthey are not identical, the system is misaligned and a re-alignmentprocedure shall be initiated.

For instance, in the aligned state each inverter can perform thefollowing steps: sends information on the data set thereof through theconnectivity network to the other inverters of the cluster; receivesinformation on the data set of at least another inverter of the clusterfrom said connectivity network (8); checks if the data set of theinverter and the data set of the other inverter are aligned.

Specifically, if the information includes or is represented by a digestof the data set, an inverter in the aligned state performs the followingsteps: calculates a first digest of the data set thereof and sends saidfirst digest through the connectivity network to the other inverters ofthe cluster; receives through the connectivity network a second digestof the data set of at least another inverter of the cluster; checks ifthe first digest and the second are identical. Moreover, if the firstdigest and the second digest are identical the inverter remains in thealigned state. Conversely, if the first digest and the second digest aredifferent from one another, the inverter shifts in the misaligned state.

In some embodiments, e.g., when the data set represent ort contains thedata setting forth the configuration of the energy generation system,each inverter in the misaligned state can perform the following steps:shares with the other inverters of the cluster the first data set andthe digest thereof, the first data set having a time stamp; when asecond data set with a time stamp is received by the inverter in themisaligned state, the inverter checks which of the first data set andsecond data set has the most recent time stamp and elects said data setwith the most recent time stamp as the data set of the inverter; repeatsthe above steps until the first data set and the second data set areidentical to one another.

Further features and embodiments of the method according to the presentdisclosure are described below, reference being made to the attacheddrawings, and are set forth in the appended claim, which form anintegral part of the present description.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

A more complete appreciation of the disclosed embodiments of theinvention and many of the attendant advantages thereof will be readilyobtained as the same becomes better understood by reference to thefollowing detailed description when considered in connection with theaccompanying drawings, wherein:

FIG. 1 illustrates an exemplary embodiment of a renewable energy sourcesystem using photovoltaic panels according to the present disclosure;

FIG. 2 illustrates a finite state machine supervising the re-alignmentmisalignment of configurations among power generators of a cluster;

FIG. 3 illustrates a block diagram concerning a validation procedure forloading and validating a configuration into the cluster;

FIG. 4 illustrates a flowchart summarizing the validating procedure;

FIG. 5 illustrates a finite state machine supervising the re-alignmentof quasi-static data among power generators of a cluster; and

FIG. 6 illustrates a diagram of data re-aggregation for re-alignment ofquasi-static data.

DETAILED DESCRIPTION

In the following description reference will be made to a photovoltaicplant, including photovoltaic panels and relevant inverters, forming acluster of power generators connected to a local grid and to aconnectivity network. It shall, however, be understood that at leastsome of the advantages disclosed herein can be achieved also when themethod is implemented in a different energy generation system, forinstance including different kinds of renewable energy sources, such asconcentrated solar power plants, wind farms, wave energy collectionplants, fuel cell systems, and the like. Also, advantageousimplementations may include sources different than renewable energysources.

More generally, methods and systems disclosed herein may be beneficialin combination with clusters of power generators, each provided with aninverter and a relevant regulator or controller, wherein the invertersof the several power generators of the cluster must be in data exchangerelationship with one another and possibly with one or more power meterscoupled to the electric grid.

Turning now to the drawings, FIG. 1 illustrates a schematic of anexemplary energy generation plant or system 1 according to the presentdisclosure. In the embodiment of FIG. 1 the energy generation system 1uses solar renewable energy. The energy generation system 1 comprises aplurality of n photovoltaic power generators 2.1, . . . 2.i, . . . 2.n.The plurality of power generators will be referred to also as a clusterof power generators herein. In preferred embodiments, each photovoltaicpower generator 2.1, . . . 2.i, . . . 2.n may include an array ofphotovoltaic panels 3.1, . . . 3.i, . . . 3.n and an inverter 4.1, . . .4.i, . . . 4.n. Each inverter 4.1, . . . , 4.i, . . . 4.n is providedwith a regulator, i.e. a controller or control unit, labeled 5.1, . . .5.i, . . . 5.n. In embodiments disclosed herein the regulator is anembedded regulator. As used herein, the term embedded regulatordesignates a regulator or controller which forms part of the inverter,rather than an external device.

Each inverter collects DC electric power from the photovoltaic panels3.1, . . . 3.i, . . . 3.n and converts it into AC electric power, whichis then distributed on a local grid 7. Loads 9 can be electricallyconnected to the local grid 7. The local grid is connected to a utilitygrid 11 at a point of common coupling PCC.

In the embodiment of FIG. 1, the system 1 further includes one or moreloads, cumulatively represented by block 9. Each power generator 2.1, .. . 2.i, . . . 2.n generates output power P_(out(1)), . . . P_(out(i)),. . . P_(out(n)). A portion P_(loads) of the generated power is suppliedto the loads 9 coupled to the local grid 7, while remaining powerP_(meter) is exported to the utility grid 11. A power meter 13, alsoreferred to as PCC meter, measures the power P_(meter) exported to theutility grid 11 and provides a feedback signal, again labeled P_(meter),which contains information on the exported power, to each powergenerator 2.1, . . . 2.i, . . . 2.n.

A connectivity network 8 can be provided for data transmission betweenthe power meter 13 and the power generators 2.1, . . . 2.i, . . . 2.n.The connectivity network 8 can feature a multicast bus, for multicastingtransmission of data among the several power generators in data exchangerelationship with the connectivity network 8. Thus, the connectivitynetwork 8 also allows transmission of data among power generators, forinstance multicast data which each power generator publishes on thenetwork for use by the other power generators, for purposes which willbecome clearer from the following description. More specifically, eachinverter 4.1, . . . 4.i, . . . 4.n includes a data receiving andtransmitting facility, to transmit data on the connectivity network 8and receive data from the connectivity network 8.

In some embodiments, each regulator 5.1, . . . 5.i, . . . 5.n is adaptedto provide control signals to regulate the output power P_(out(1)), . .. P_(out(i)), . . . P_(out(n)) delivered by each power generator 2.1, .. . 2.i, . . . 2.n. The feedback signal is provided to each one of saidP_(meter) regulators 5.1, . . . 5.i, . . . 5.n through the connectivitynetwork 8 and each regulator generates a control signal for the relevantpower generator 2.1, . . . 2.i, . . . 2.n, i.e. a signal controlling theoperation of the relevant inerter 4.1, . . . 4.i, . . . 4.n.

Each regulator 5.1, . . . 5.i, . . . 5.n can be implemented as ahardware device, as a control software or as a hybrid hardware andsoftware device, and can be embedded in or form part of the inverter ofthe relevant power generator 2.1, . . . 2.i, . . . 2.n.

Based upon the control signal provided by the respective regulator 5.1,. . . 5.i, . . . 5.n, the output power P_(out(1)), . . . P_(out(i)), . .. P_(out(n)) of each generator 2.1, . . . 2.i, . . . 2.n is maintainedunder a respective limit threshold P_(limit(1)), . . . P_(limit(i)), . .. P_(limit(n)), for instance. In the diagram of FIG. 2 P_(outTOT)indicates the total power generated by the inverters 2.1, . . . 2.i, . .. 2.n. The regulators 5.1, . . . 5.i, . . . 5.n can be adapted to limitthe power generated by each generator 2.1, . . . 2.i, . . . 2.n suchthat the total power output P_(outTOT), minus the power P_(loads)absorbed by the loads 9 is maintained under a target power exportationlimit value P_(PCC). Each regulator performs a control algorithm toprovide a limitation signal for the relevant inverter based upon thetotal power output P_(outTOT), and the active power P_(meter) exportedto the utility grid 11 at the point of common coupling PCC. Thelimitation signals of the inverters 4.1, . . . 4.i, . . . 4.n are aimedat maintaining the actual power P_(meter) exported to the utility grid11 under the target power exportation limit value P_(PCC).

The inverters 4.1, . . . 4.2, . . . 4.n can be connected to one anotherusing a daisy chain configuration or a star topology, for instance. Dataexchange between power generators becomes thus possible, such thatregulators or controllers 5.1, . . . 5.i, . . . 5.n of the powergenerators can receive data from the other power generators and relevantcontrollers for the purposes explained here on.

Each inverter has its own IP address and all IP addresses of theinverters forming an inverter cluster participate to a closed loopcontrol process. The inverters of the cluster are on the same subnet ofa local network. The power meter 13 can be any meter adapted to exchangeinformation through the connectivity network 8 with the inverters 4.1, .. . , 4.i, . . . 4.n, i.e. with the control units 5.1, . . . 5.i, . . .5.n thereof. For instance the power meter 13 can be an RS485 meter. Inthis case, the power meter will be connected to the network 8 using oneof the inverters forming the cluster as a gateway. In other embodiments,the power meter can be a TCP power meter directly connected to theconnectivity network 8.

The inverter cluster and other relevant apparatus connected to theconnectivity network 8 shall be configured according to a systemconfiguration. The configuration of system 1 includes a plurality ofparameters and pieces of information, which are required for the powergenerators 2.1, . . . , 2.i, . . . 2.n to operate in combination withone another in a coordinated manner. The configuration thus consists ina data set, which can be made available to the inverters for instance inthe form of a package of serialized data.

Each inverter 2.1 . . . , 2.i, . . . 2.n, i.e. the controller orregulator 5.1, . . . 5.i, . . . 5.n thereof, shall have sufficientinformation on the system configuration for it to properly control therespective power generator. The configuration of the system 1 can beuploaded in the various devices of the system. The configuration databecome thus available to the control unit of each device connected tothe connectivity network 8 of the system. Uploading of the configurationcan be through an installer APP running on a portable apparatus, forinstance. The portable apparatus can be any apparatus suitable for thispurpose, e.g. a laptop, a tablet or a smartphone, schematically shown at10 in FIG. 1.

In some embodiments, the configuration APP can allow the user to: setthe nominal power of the plant or system 1; select the inverters formingpart of the cluster, e.g., by selecting the relevant IP addresses;select one or more power meters providing measures on power flowing inspecific points of the system, for instance and specifically theexported power, i.e., the power flowing through the point of commoncoupling PCC to the utility grid 11; power threshold data relating toexport power control, for instance the percentage of the nominal plantpower to export on the utility grid 11; a guard band percentage thatwill act as an additional restriction to the active power exported tothe utility grid.

The system configuration can be modified and each configuration ischaracterized by a timestamp, for the purpose which will become clearfrom the following description.

Possible steps to load a configuration onto the control units of theinverters 4.1, . . . 4.i, . . . 4.n of the cluster will be describedlater on. The configuration needs to be shared by all inverters and eachinverter shall share the same configuration, i.e., the configurationsstored in the plurality of inverters forming the cluster of system 1shall be aligned. According to the method disclosed herein, alignment ofthe configuration among all the inverters is based on apublish/subscribe pattern and upon multicast messages.

In fully operational condition each inverter periodically sharesinformation on the configuration stored in it, for example in a memoryaccessible by the controller or regulator 5.1, . . . 5.i, . . . 5.nthereof. More specifically, each inverter will publish on theconnectivity network 8 the information on the configuration storedtherein. Sharing of this information can be through a multicast messageon the connectivity network 8. Consequently, each inverter receivesinformation on the configuration stored in each inverter of the cluster.It is thus possible to check if the same configuration is stored in eachinverter, or else if a misalignment is present. As noted above, forcorrect operation of the system 1, all power generators 2.1, . . . 2.i,. . . 2.n shall share the same configuration.

In possible embodiments, the inverters may transmit by multicast amessage or a set of messages containing the whole configuration data.However, in order to reduce the amount of data shared on theconnectivity network 8 and thus to save bandwidth, in currentlypreferred embodiments each inverter will transmit to the other invertersa more compact message, for instance a digest, i.e., a hash, of theconfiguration stored in it. In some embodiments the SHA256 of the storedconfiguration can be calculated by each inverter and shared with theother inverters by multicasting transmission thereof on the connectivitynetwork 8.

If all inverters have the same configuration stored therein, the SHA256,or any other suitable hash or digest thereof, will be identical for allinverters. Each inverter collects the digest received from the otherinverters and checks whether the digests are all identical to oneanother. If at least one inverter has a misaligned configuration, i.e.,a configuration differing from the configurations of the otherinverters, this will result in an inconsistent digest, i.e., eachinverter will receive at least one digest which is different from theothers.

When an inverter detects a misalignment in the configuration of theinverters, i.e., an inconsistency between digests of the variousconfigurations shared by multicasting on the connectivity network 8, theinverter will be placed in a misaligned state and will share thecomplete configuration thereof with all inverter for realignment. Inother words, each inverter will publish on the connectivity network 8the full configuration in an attempt to load it into the otherinverters. It is sufficient for a misaligned state to arise if twodigests of the configuration available to two inverters are differentfrom one another. Thus, the realignment procedure can start as soon asone misaligned digest is received.

In order for the inverters to re-align, the configuration with thelatest (i.e., most recent) timestamp will be considered the valid one byall inverters taking part to the re-alignment process. All the inverterswill thus converge to the most recent configuration and load it into thestorage memory thereof.

More specifically, in some embodiments, each inverter in the misalignedstate, which receives a configuration from another inverter, willcompare the configuration stored in it and the received configuration,will select the one of said configurations having the most recenttimestamp and store it as the new, valid configuration. At the nextiterative step (next timer tick), the inverter in the misaligned statewill send the newly selected configuration to the other inverters, andthe digest thereof. The result of this procedure will be converging ofall inverters to the same configuration.

The re-alignment process described above will end once the configurationhas been stable among all inverters for a preset amount of time (apre-set of timer ticks), and it will be applied to all inverters whichwill then shift from the misaligned state to the aligned state again andbecome fully operational again.

FIG. 2 illustrates a finite state machine supervising the abovedescribed process. In the diagram of FIG. 2 the two states of theinverter are illustrated, namely aligned (all digests received areidentical to one another), or misaligned (at least one digest receivedis different from the others). The inputs affecting the state of theinverters are also represented by relevant blocks in the diagram. Whenthe inverter is in the misaligned state, it will publish the completeconfiguration and the digest (SHA) thereof as well, since checking thealignment condition is performed by comparing the configurations digestsreceived by the inverters. As can be understood from the finite statemachine illustrated in FIG. 2, the inverter remains in the aligned stateas long as the digests (SHA) received are all identical to one another.Each inverter will send at every timer tick the digest of theconfiguration stored therein.

When misaligned SHAs are received, the inverter is shifted from thealigned to the misaligned state. At each timer tick the inverter willnow send the complete configuration and the digest (SHA) thereof to theother inverters. The state of the inverter is shifted from misaligned toaligned again when the configuration is stabilized.

Configuration misalignment may occur for instance when a new inverter isadded to the cluster, or when a dormant inverter is put into operation.A configuration misalignment also occurs when the user loads an updatedconfiguration into one of the inverters, which then transmits the newconfiguration to the other inverters for configuration updating. In thislatter case, for instance, the user will connect to a selected one ofthe inverters, for instance, and load a new (updated) configurationtherein. The inverter in question calculates the digest of the newconfiguration and transmits the digest (e.g. the SHA256). All invertersare then placed in the misaligned state, since one of the digestsreceived by all inverters is inconsistent with the others. Since the newconfiguration loaded on the inverter has the most recent time stamp, theabove described procedure will cause all the inverters to converge tothe new configuration, i.e., the new configuration will replace the oldconfiguration in all inverters. The digest of the new configurationcalculated by all inverters becomes now identical to one another and theinverters are shifted from the misaligned to the aligned state.

During operation the configuration of the entire system 1 can bedetected by connecting to any one of the devices attached to theconnectivity network, since the configuration is stored in each powergenerator 2.1, . . . 2.i, . . . 2.n. Data on the configuration becomeunavailable if the inverter is in the misaligned state, but becomeavailable again as soon as the device is switched back into the alignedstate.

In operation, the system 1 is characterized by quasi-static data.Quasi-static data as used herein, may be understood as those data whichsatisfy the following rules: their rate of change is much slower thanthe characteristic period of the system, for instance 1 second; the dataare needed for performing at least one task of the system, for instancefor controlling the power export on the utility grid 11; and the datashall be synchronized in the whole system, i.e., each inverter of thesystem shall have the same values of the quasi-static data stored in it.

Examples of quasi-static data are: rated power of the inverter; inverteridentification data; commissioning status; available and configuredpower meters in the cluster.

Each inverter may provide one or more quasi-static data. Eachquasi-static datum is identified by a key and takes a value, which canbe time-variable. Quasi-static data can be mapped in a map containing,for each quasi-static datum: an identification (for instance a univocalID number) of the device providing the datum; the key of the datum, andthe current value of the datum. The quasi-static data can be serializedin a sequence of bits for multicast transmission through theconnectivity network 8 to each power generator 2.1, . . . 2.i, . . . 2.nof the system 1.

The set of quasi-static data shall be shared among all power generators2.1, . . . 2.i, . . . 2.n and shall be synchronized, i.e., eachcontroller of the power generators shall share the same set of data. Inorder to check whether the quasi-static data are synchronized, duringoperation each controller can transmit iteratively the serializedpackage containing the quasi-static data on the connectivity network 8to all other controllers of the power generators. In preferredembodiments, to reduce the amount of data to be transmitted on theconnectivity network and thus save bandwidth, a digest of the serializedquasi-static data is transmitted, rather than the serializedquasi-static data themselves. For instance the SHA256 of the serializedquasi-static data can be used.

Each controller of the power generators can check if the data aresynchronized by simply comparing the received digests. If the digests ofthe serialized data packages are identical to one another, the data aresynchronized and the controller remains in an aligned state.

If, for instance, a datum provided by one power generator changes, theresulting digest of the serialized data package will differ from thedigest of the other data packages provided by the controllers of theother power generators. This will cause power generators to receivediffering digests. This situation will switch the power generator fromthe aligned state to a misaligned state.

Re-synchronization of the system is performed in a similar manner asdescribed for the synchronization of the configurations. A controllerwhich is in a misaligned state will start transmitting through thenetwork 8 the quasi-static data, such that a new serialized map ofquasi-static data can be calculated by all the controllers and thedigest thereof can be computed anew and transmitted by multicasting onthe network 8. The process will finally converge towards a newstabilized set of quasi-static data.

In some embodiments, in order to save bandwidth, each controller whichis placed in a misaligned state will transmit only the data it hasownership of. For instance, only the inverter data and the own monitoredmeter data are transmitted. Each inverter will thus receive quasi-staticdata from all inverters and will be able to re-aggregate the data to getthe complete picture of the system. The digest of the re-aggregated datais calculated.

When a stabilized set of quasi-static data is achieved, the powergenerators are shifted back in the aligned state.

FIG. 4 illustrates the finite state machine supervising the abovedescribed process and FIG. 5 illustrates the multicast transmission ofsingle inverter data by each misaligned inverter to the other invertersof the system, and re-aggregation of data at each inverter tore-construct the entire map of quasi-static data of the system 1.

Once the quasi-static data are synchronized, i.e., each inverter hasstored the same quasi-static data set, said data are available from anyone of the inverters 4.1, . . . 4.i, . . . 4.n of the system 1. They canfor instance be downloaded from any one of the inverters.

As mentioned above, each controller 5.1, . . . 5.i, . . . 5.n of theseveral power generators 2.1, . . . 2.i, . . . 2.n shall have access toa data set defining the configuration of the whole energy generationsystem 1. The data set of the system configuration shall be loaded inall inverters before start-up and may require updating.

Loading the configuration may be critical from a cybersecurityperspective. Thus, in some embodiments a cyber-secure procedure isenvisaged, which prevents loading of unauthorized, or non-authenticconfigurations into the inverters of the cluster. Two cybersecurityissues are to be considered. The APP loading the configuration shallsign the configuration. The inverter receiving the configuration shallbe able to check if the signature is authorized by a certificationauthority and to validate the configuration received.

The certification authority can be, or controlled by, the entity whichmanufactures or provides the inverters of the cluster. The certificationauthority can be accessed through a portal or a cloud service. For abetter understanding of the procedure described here below, referenceshall be made to the diagram of FIG. 3.

For the validation process, a public-key cryptography system is used.The certification authority uses a set of public key and private key forasymmetric cryptography. These keys will be hereon indicated asPublKey_CA and PrivKey_CA, respectively. The public key PublKey_CA ofthe certification authority is available to each inverter 4.i or otherdevice, which shall be connected to the connectivity network 8 and whichshould receive the configuration of the system 1. For instance thePubKey_CA can be stored in a storage memory accessible by the controlunit of the inverter when the relevant control software is loaded in theinverter.

The APP, which is used to load the configuration into the devices of thesystem 1, will have its own public/private key pair for asymmetriccryptography. This set of keys can be generate by the APP at its firstrun and stored in the secure storage of the device on which the APPruns. These keys will be indicated as PublKey_APP and PrivKey_APP,respectively.

In summary, the validation process performed by the device into whichthe configuration of the system 1 is first loaded performs a firstvalidation step to check if the APP attempting to load the configurationis authorized by the certification authority. The second step is tovalidate the configuration itself.

The APP shall be authorized by the certification authority as a firststep. If the latter is accessible through a cloud service, for instance,the APP will access the cloud service through the credentials of the APPitself. Once access to the certification authority has been granted, theAPP will send its public key PubKey_APP to the certification authority,which will sign the PubKey_APP using the private key PrivKey_CA of thecertification authority. The signed PubKey_APP, i.e. the PubKey_APPencrypted with PrivKey_1, is returned to the APP and stored in thedevice on which the APP is running Specifically, the hash of PubKey_APPis calculated first, and the hash of the PubKey_APP is signed by thecertification authority using the private key PrivKey_CA of thecertification authority.

The signed hash of the PubKey_APP will be used by the inverter intowhich the APP attempts to inject the configuration to check that the APPis authorized by the certification authority to load a configuration inthe system.

Referring now to the diagram of FIG. 3, reference number 101 indicatesthe device, e.g. a smartphone or other portable device with internetconnectivity, on which the APP runs. Reference number 103 schematicallyrepresents the cloud service of the certification authority. In theexample of FIG. 3 the portable device is in data communication with theinverter 4.1. Thus, the configuration will be loaded in said inverterand subsequently distributed to the other inverters of the cluster bymulticasting through the connectivity network 8.

The user will load the configuration of the system 1 in the device 101using the APP. The configuration data may include, a timestamp of theconfiguration, the nominal power of the plant, set point as percentageof the plant nominal power, percentage of the plant nominal power asguard band for measurement errors, percentage of the plant nominal poweras set point value for fail safe operations, deadline time for controlapplications, meter or meters to be used for exported power feedbackmeasurements among all found meters, list of all inverters participatingto the control action.

Once the configuration data have been loaded, the APP will sign theconfiguration as follows. It will calculate a digest, i.e. a hash, ofthe configuration data package and will encrypt the hash using theprivate key of the APP (PrivKey_APP).

The next step is to post the configuration. In the schematic diagram ofFIG. 3 the APP loads the configuration into one of the inverters, by wayof example inverter 4.1, hereon also referred to as the receivingdevice. The data loaded into the inverter are: the configuration, thehash of the configuration encrypted with PrivKey_APP. The APP willcalculate also the hash of its own public key PubKey_APP and transmitsthe hash of the PubKey_APP as well as the signed version thereof,encrypted with PrivKey_CA, previously received from the certificationauthority 103. This data set is aimed at allowing the receiving device(inverter 4.1 in the described example) to perform two tasks, namely: tocheck if the transmitting APP is authorized to communicate with thereceiving device, which is done by validating the public key PubKey_APP;and, secondly, to validate the received configuration.

The validation process executed by the receiving device 4.1 is asfollows. The PubKey_CA is available to the receiving device, forinstance is stored in a storage memory accessible by the controller ofthe receiving device. The receiving device is thus able to decrypt thesigned (encrypted) hash of PubKey_APP, which has been signed withPrivKey_CA. If the decrypted hash of PubKey_APP is identical with thehash of PubKey_APP transmitted by the APP to the receiving device, thekey is validated and the receiving device acknowledges that the APPtransmitting the configuration is certified by the certificationauthority.

If this first validation step is unsuccessful, the configuration is notloaded in the receiving device.

If the validation step is successfully concluded, the receiving devicemust validate the configuration itself, e.g., to check that it has notbeen altered. This is done by decrypting the hash of the configuration,which has been encrypted by the APP with PrivKey_APP, using thePubKey_APP, which the APP has made available to the receiving device.The receiving device has also received the configuration itself; thus itwill calculate the hash of the received configuration. If the calculatedhash and the decrypted hash are identical to one another, theconfiguration is validated.

The receiving device 4.1 is now able to share the received data(configuration and encrypted hash of the configuration) on a multicastbus 105 (see FIG. 3), forming part of the connectivity network 8, suchthat each device connected to the network 8 can receive the same dataand validate the configuration by repeating the above described process.

The above described validation procedure is summarized in the flowchartof FIG. 4.

At the end of the above described procedure, each receiving device,i.e., for instance each control unit of the inverters 4.i, will have avalidated configuration of the system loaded therein.

While the invention has been described in terms of various specificembodiments, it will be apparent to those of ordinary skill in the artthat many modifications, changes, and omissions are possible withoutdeparting form the spirit and scope of the claims. In addition, unlessspecified otherwise herein, the order or sequence of any process ormethod steps may be varied or re-sequenced according to alternativeembodiments.

1-10. (canceled)
 11. A method for managing an energy generation system,including a cluster of power generators connected by a connectivitynetwork, each power generator including an inverter having a respectivecontroller, and at least a data set available to the controller forcontrolling the respective power generator; wherein: each invertertransmits through said connectivity network, to the other inverters ofthe cluster, information concerning said data set available to it, saidinformation being sufficient to check whether the data sets available toeach inverter are aligned; each inverter receives, through saidconnectivity network, information concerning the data set available toother inverters of the cluster; each inverter checks if the data setsare aligned; if the data sets are aligned, the inverter remains in analigned state; and if the data sets are misaligned, the inverter shiftsin a misaligned state and sends data through the connectivity network tore-align the data sets, and shifts back in the aligned state once thedata sets are realigned.
 12. The method of claim 11, wherein the dataset includes at least one of a configuration of the energy generationsystem and a map of quasi-static data of the energy generation system.13. The method of claim 11, wherein said information includes a digestof at least a portion of the data set.
 14. The method of claim 11,wherein, in the aligned state each inverter performs the followingsteps: sends information on the data set thereof through theconnectivity network to the other inverters of the cluster; receivesinformation on the data set of at least another inverter of the clusterfrom said connectivity network; checks if the data set of the inverterand the data set of the other inverter are aligned.
 15. The method ofclaim 11, wherein: said information includes a digest of the data set;and each inverter in the aligned state performs the following steps:calculates a first digest of the data set thereof and sends said firstdigest through the connectivity network to the other inverters of thecluster; receives through said connectivity network a second digest ofthe data set of at least another inverter of the cluster; checks if thefirst digest and the second are identical; if the first digest and thesecond digest are identical the inverter remains in the aligned state;and if the first digest and the second digest are different from oneanother, the inverter shifts in the misaligned state.
 16. The method ofclaim 15, wherein each inverter in the misaligned state performs thefollowing steps: (a) shares with the other inverters of the cluster thefirst data set and the digest thereof, the first data set having a timestamp; (b) when a second data set with a time stamp is received by theinverter in the misaligned state, the inverter checks which of the firstdata set and second data set has the most recent time stamp and electssaid data set with the most recent time stamp as the data set of theinverter; and repeats steps (a) and (b) until the first data set and thesecond data set are identical to one another.
 17. The method of claim15, wherein each inverter in the misaligned state performs the followingsteps: shares with the other inverters of the cluster a first sub-set ofsaid first data set; receives sub-sets of the data sets of the otherinverters of the cluster and re-aggregates a full data set by combiningthe sub-sets; shifts to the aligned state when the re-aggregated dataset is stabilized.
 18. The method of claim 11, further comprisingpreliminary steps of: loading a configuration of the system in one ofsaid inverters; and propagating the configuration from said one of saidinverters to the other inverters of the system through the connectivitynetwork.
 19. The method of claim 18, further comprising the followingstep: the inverter receiving the configuration validates theconfiguration.
 20. An energy generation system comprising: a cluster ofpower generators connected by a connectivity network, each powergenerator including an inverter having a respective controller, and atleast a data set available to the controller for controlling therespective power generator; wherein for each power generator therespective controller is configured such that: each inverter transmitsthrough said connectivity network, to the other inverters of thecluster, information concerning said data set available to it, saidinformation being sufficient to check whether the data sets available toeach inverter are aligned; each inverter receives, through saidconnectivity network, information concerning the data set available toother inverters of the cluster; each inverter checks if the data setsare aligned; if the data sets are aligned, the inverter remains in analigned state; and if the data sets are misaligned, the inverter shiftsin a misaligned state and sends data through the connectivity network tore-align the data sets, and shifts back in the aligned state once thedata sets are realigned.
 21. The energy generation system of claim 20,wherein the data set includes at least one of a configuration of theenergy generation system and a map of quasi-static data of the energygeneration system.
 22. The energy generation system of claim 20, whereinsaid information includes a digest of at least a portion of the dataset.
 23. The energy generation system of claim 20, wherein for eachpower generator the respective controller is configured such that, inthe aligned state each inverter: sends information on the data setthereof through the connectivity network to the other inverters of thecluster; receives information on the data set of at least anotherinverter of the cluster from said connectivity network; checks if thedata set of the inverter and the data set of the other inverter arealigned.
 24. The energy generation system of claim 20, wherein: saidinformation includes a digest of the data set; and for each powergenerator the respective controller is configured such that eachinverter in the aligned state: calculates a first digest of the data setthereof and sends said first digest through the connectivity network tothe other inverters of the cluster; receives through said connectivitynetwork a second digest of the data set of at least another inverter ofthe cluster; checks if the first digest and the second are identical; ifthe first digest and the second digest are identical the inverterremains in the aligned state; and if the first digest and the seconddigest are different from one another, the inverter shifts in themisaligned state.
 25. The energy generation system of claim 24, whereinfor each power generator the respective controller is configured suchthat each inverter in the misaligned state: (a) shares with the otherinverters of the cluster the first data set and the digest thereof, thefirst data set having a time stamp; (b) when a second data set with atime stamp is received by the inverter in the misaligned state, theinverter checks which of the first data set and second data set has themost recent time stamp and elects said data set with the most recenttime stamp as the data set of the inverter; and repeats (a) and (b)until the first data set and the second data set are identical to oneanother.
 26. The energy generation system of claim 24, wherein for eachpower generator the respective controller is configured such that eachinverter in the misaligned state: shares with the other inverters of thecluster a first sub-set of said first data set; receives sub-sets of thedata sets of the other inverters of the cluster and re-aggregates a fulldata set by combining the sub-sets; shifts to the aligned state when there-aggregated data set is stabilized.
 27. The energy generation systemof claim 20, wherein at least one controller is configured to: load aconfiguration of the system in an associated one of said inverters; andpropagate the configuration from said one of said inverters to the otherinverters of the system through the connectivity network.
 28. The energygeneration system of claim 27, wherein the controller associated withthe inverter receiving the configuration is configured to validate theconfiguration.